ChuckandClaude Opus 5 68f267143b fix(web): escape registry and upload values in plugin manager inline handlers ...

The store, saved-repository and custom-registry buttons built
onclick='...(${JSON.stringify(id)})...'. JSON.stringify leaves ' alone,
so a custom registry entry whose id contained ' closed the attribute and
added its own handler. One helper, jsStringAttr(), now HTML-escapes the
JSON literal for every one of those handlers, and the store View button
opens only http(s) repo links.

The live window.updateImageList (plugins_manager.js loads last, so its
copy wins over the file-upload widget's) wrote the uploaded file's
original name, path and ids into markup raw; they are escaped now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-09-17 08:50:09 -04:00

..

icons

Web UI: mobile navigation, guided onboarding, basic/advanced config tiering + performance (#417)

2026-07-16 20:32:07 -04:00

js

fix(web): update-all skips Starlark apps and no longer misses plugins (#587)

2026-09-15 18:09:11 -04:00

vendor

Web UI: mobile navigation, guided onboarding, basic/advanced config tiering + performance (#417)

2026-07-16 20:32:07 -04:00

app.css

fix(web): harden, polish and optimize the web UI per the Sept 2026 audit (#568)

2026-09-14 09:42:24 -04:00

app.js

fix(web): harden, polish and optimize the web UI per the Sept 2026 audit (#568)

2026-09-14 09:42:24 -04:00

manifest.json

Web UI: mobile navigation, guided onboarding, basic/advanced config tiering + performance (#417)

2026-07-16 20:32:07 -04:00

plugins_manager.js

fix(web): escape registry and upload values in plugin manager inline handlers

2026-09-17 08:50:09 -04:00